Do all US states require breach notification?

Yes. As of January 2025, all 50 US states have breach-notification laws, though the deadline, threshold, and who you must notify differ by state. Check your state Attorney General for current requirements.

What Changes When You Store Customer Data

Q: What legally changes the moment you store customer data?

You take on customer data obligations that did not exist when you were pre-storage. In the United States these are mostly state-administered. Federal rules include HIPAA, GLBA, FTC Act Section 5, and COPPA. State-administered requirements include breach notification (all 50 states) and comprehensive privacy laws (a growing number of states).

Q: What will my first enterprise client require?

Your first enterprise client will often require a Data Processing Addendum (DPA) and proof of a written security policy.

Customer data storage: inherit privacy obligations, cyber insurance needs, and DPA requirements — verify your state's rules now.

This content is general information only and is not legal, tax, financial or insurance advice. Speak to an appropriately licensed professional before acting on it.

Last updated: January 2025.

🎯 When you start storing customer data, three things change at once: you inherit data-privacy obligations (disclosure, deletion, and breach-notification duties), you become a target that needs cyber insurance, and your client contracts start demanding data-protection clauses. In the US, breach-notification laws exist in all 50 states, and a growing number of states have comprehensive privacy statutes — the exact rules vary by state. This is a trigger event: the moment you hold a customer's name, email, payment detail, or health record, a new set of duties switches on.

TL;DR

All 50 US states have breach-notification laws; a growing number of states have comprehensive consumer-privacy statutes — requirements vary by state, so check your state AG.
Your first enterprise client will often require a Data Processing Addendum (DPA) and proof of a written security policy.

⚠️ Before you buy any tool, policy template, or insurance policy, verify your specific obligations with your state Attorney General's office. Requirements, deadlines, and thresholds vary by state and change frequently. Do not treat this guide as legal advice or a substitute for confirming current rules with your state AG or a qualified attorney.

Definition — "storing customer data": You are storing customer data the moment your business retains any personal information about a customer beyond a single transaction. That includes names, emails, phone numbers, payment card details, IP addresses, health information, or behavioral data held in a CRM, spreadsheet, database, form tool, or backup. Storage is the trigger, not the size of the dataset. One email address in a Mailchimp list counts.

What legally changes the moment you store customer data

The moment you store customer data, you take on customer data obligations that did not exist when you were pre-storage. In the United States these are mostly state-administered, so there is no single nationwide rule. Here is what is federal versus what varies by state.

Federal (applies nationwide):

HIPAA if you store protected health information as a covered entity or business associate (HHS HIPAA overview, reviewed January 2025).
GLBA if you handle consumer financial data.
FTC Act Section 5 — the FTC has enforced "unfair or deceptive" data practices against small businesses for failing to secure data (FTC Data Security guidance, reviewed January 2025).
COPPA if you collect data from children under 13.

State-administered (requirements vary — check your state):

Breach notification exists in all 50 states, but the deadline, threshold, and who you must notify differ. The National Conference of State Legislatures maintains the state breach-notification list (reviewed January 2025), which tracks each state's statute, notification deadline, and enforcement authority.
Comprehensive privacy statutes (California CCPA/CPRA, Virginia VCDPA, Colorado CPA, and others) grant consumers rights to access, delete, and opt out of the sale of their data. Thresholds for coverage vary by revenue and record count, so confirm whether your business is in scope with your state AG.

Building a defensible security posture

Once storage triggers these duties, the practical fix is a documented, reasonable security posture. Regulators and enterprise clients both look for evidence that you took recognized steps rather than a specific product. Two widely cited frameworks help you demonstrate that:

The NIST Cybersecurity Framework provides a plain-language structure (Identify, Protect, Detect, Respond, Recover) that scales to small businesses (NIST CSF, reviewed January 2025).
The CISA Cyber Essentials guide translates those principles into concrete starter actions for small organizations (CISA Cyber Essentials, reviewed January 2025).

At minimum, a defensible posture includes a written information security policy, an incident-response and breach-notification plan, access controls with unique logins, encryption of stored personal data, regular backups, and a data-retention schedule so you are not holding data you no longer need.

What changes in your client contracts

Your first enterprise or regulated client will often require a Data Processing Addendum (DPA) and proof of a written security policy before signing. Expect contract language covering breach-notification timelines (often 24–72 hours), data-deletion obligations at contract end, subprocessor disclosure, and the right to audit or request a security questionnaire. Having your policy and posture documented in advance shortens sales cycles and prevents you from agreeing to obligations you cannot meet.

Methodology

This guide is a neutral, fit-first reference. Legal categories were checked against the cited federal agency pages (HHS, FTC), the NCSL state breach-notification tracker, and the NIST and CISA security frameworks, all reviewed January 2025. Nothing here is legal advice — verify your specific obligations with your state Attorney General or a qualified attorney before acting.